Custom auth domain — sketch + park

2026-05-13 · 🅿️ sketched + parked — resume signal is client-facing, not aesthetic.

The thing

Cloudflare Zero Trust currently lands users at https://xlabs.cloudflareaccess.com/... when they hit a gated surface (devreports.dare.co.uk, audreyinc-beta, audrey-dashboard, etc.). For solo internal use that URL is fine. For anything client-facing, it reads as:

• Generic CDN, security layer, and DNS provider sitting in front of dare.co.uk.">CF-provider branding, not yours
• “Is this a phishing site?” pause moment for first-time visitors
• Wrong-domain credibility hit during what should be a confident login

The fix is a custom auth domain — auth.<something> — that takes over the login surface. End user sees a redirect through your brand. CDN, security layer, and DNS provider sitting in front of dare.co.uk.">CF Access still does the work behind it.

Architecture

                     ┌──────────────────────────────────┐
  Client hits gated  │  https://<gated-surface>         │
  surface            │  (devreports / dashboards /      │
                     │   client-specific portals)       │
                     └─────────────────┬────────────────┘
                                       │ unauthenticated
                                       ▼
                     ┌──────────────────────────────────┐
                     │  CF Access redirect to:          │
                     │  https://auth.<your-domain>/     │
                     │      cdn-cgi/access/...          │
                     │  (instead of                     │
                     │   xlabs.cloudflareaccess.com)    │
                     └─────────────────┬────────────────┘
                                       │
                                       ▼
                     ┌──────────────────────────────────┐
                     │  One-Time-PIN challenge          │
                     └─────────────────┬────────────────┘
                                       │ ✓ authenticated
                                       ▼
                     ┌──────────────────────────────────┐
                     │  Back to gated surface           │
                     └──────────────────────────────────┘

Single auth domain serves the whole portfolio. Clients on any gated surface (dare, audrey, dogwood, future client engagements) authenticate through one canonical URL.

Hostname candidates

Per the short-URL preference, brevity is weighted; per the client-facing-trust trigger, the URL must read as legitimate to outside eyes.

Senior recommendation: auth.xlabs.digital

Three reasons:

1. xlabs matches the canonical infra org name (xlab-co). Auth surface is infrastructure, not brand-customer-facing — it belongs under the infra umbrella, not under any one brand’s parent domain.
2. .digital TLD reads as a deliberate technical choice. Modern, decisive, agency-friendly. Reads “we know what we’re doing” to a client seeing it for the first time.
3. Decouples auth from the dare.co.uk personal brand. As xlabs ↔ client work grows (per the agency-tenant IAM model parked earlier), having auth on a neutral infra domain stops “why is my auth on a stranger’s personal site?” friction.

Trade-off vs. auth.gf.cx: the 8-character length penalty is the cost of client-facing trust. Acceptable.

Trade-off vs. auth.dare.co.uk: parity on length, win on neutral-infra positioning, mild lift in technical-credibility reading.

When auth.gf.cx would win instead

If the resume signal stays strictly internal — i.e., you never hand a gated URL to a client, contractor, advisor, or external collaborator — auth.gf.cx is correct. The brevity preference wins when client-facing trust isn’t on the line.

Setup (when un-parked)

All gated surfaces (current + future) automatically use the new domain. Zero per-app reconfig.

Why one auth domain across the portfolio

Auth surface is operational infrastructure, not customer brand experience. The customer brand lives on audreyinc.com (the storefront) or dogwood.house (the booking site) — public, marketing-led. The authenticated layer is back-of-house; centralised infra naming wins there.

Resume signals — concrete

The interim signal — Option 2 team rename (xlabs → dare or xlab on xlabs.cloudflareaccess.com) — is the cheap version. Worth doing whenever it bothers you; doesn’t block the custom-domain decision.

Cost

$0. Free Cloudflare feature.

What this does NOT do

• Doesn’t add identity providers (still One-Time-PIN by default; SSO/Google/GitHub IdP is a separate Zero Trust config)
• Doesn’t change Access app policies (still per-app, gated by groups)
• Doesn’t expose the auth flow to crawlers (it’s still a redirect target, not a public page)

Counter-pattern

Don’t build this before a client engagement actually wants it. The current xlabs.cloudflareaccess.com URL is fine for solo internal use. Premature custom-domain work is the exact “polish dressed up as infrastructure” anti-pattern the 80/20 strategic-peer frame catches.

Pattern connections

• feedback_park_with_resume_conditions — sketched-and-parked is the deliverable
• feedback_short_url_preference — hostname brevity weighting that informed the candidate comparison
• feedback_principle_of_least_privilege — single auth domain = single attack surface, not three brand-flavored ones
• feedback_just_in_time_permission_grants — same temporal logic: build when a workflow demands it, not before
• reference_gcp_cli_and_agency_iam — when client folders/projects come online, this pattern slots into the agency runbook naturally
• xlab_studio_rename_sweep_2026-05-13 — sibling sketch with the same closing-aphorism shape (“discovery before action is the discipline; the rename itself takes 5 minutes once the sweep is done”); different domain, same load-bearing structure of invisible-work-vs-visible-work

Trust-signal infrastructure. Cheap when triggered, premature when not.